JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 195.26.248.142

195.26.248.142 was found in our database!

This IP was reported 241 times. Confidence of Abuse is 100%: ?

100%

ISP	Contabo GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS40021
Hostname(s)	vmi3317559.contaboserver.net
Domain Name	contabo.com
Country	🇺🇸 United States of America
City	St. Louis, Missouri

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 195.26.248.142

Whois 195.26.248.142

IP Abuse Reports for 195.26.248.142:

This IP address has been reported a total of 241 times from 201 distinct sources. 195.26.248.142 was first reported on October 31st 2026, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 Peregrine	2026-11-05 03:17:40 (14 hours ago)	Fail2Ban Jail:IU tomcat-honeypot \| Evidence: - 195.26.248.142 - - [02/Nov/2026:13:27:25 -0300] "GET ... show more Fail2Ban Jail:IU tomcat-honeypot \| Evidence: - 195.26.248.142 - - [02/Nov/2026:13:27:25 -0300] "GET /.aws/credentials HTTP/1.1" 404 - - 195.26.248.142 - - [02/Nov/2026:13:27:25 -0300] "GET /.aws/config HTTP/1.1" 404 - - 195.26.248.142 - - [02/Nov/2026:13:27:25 -0300] "GET /.git/config HTTP/1.1" 404 - - 195.26.248.142 - - [02/Nov/2026:13:27:27 -0300] "GET /.git/HEAD HTTP/1.1" 404 - - 195.26.248.142 - - [02/Nov/2026:13:27:28 -0300] "GET /.ssh/id_rsa HTTP/1.1" 404 - show less	Bad Web Bot
🇬🇧 sc user	2026-11-04 20:06:20 (22 hours ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan
🇧🇷 Peregrine	2026-11-04 03:17:40 (1 day ago)	Fail2Ban Jail:IU tomcat-honeypot \| Evidence: - 195.26.248.142 - - [02/Nov/2026:13:27:25 -0300] "GET ... show more Fail2Ban Jail:IU tomcat-honeypot \| Evidence: - 195.26.248.142 - - [02/Nov/2026:13:27:25 -0300] "GET /.aws/credentials HTTP/1.1" 404 - - 195.26.248.142 - - [02/Nov/2026:13:27:25 -0300] "GET /.aws/config HTTP/1.1" 404 - - 195.26.248.142 - - [02/Nov/2026:13:27:25 -0300] "GET /.git/config HTTP/1.1" 404 - - 195.26.248.142 - - [02/Nov/2026:13:27:27 -0300] "GET /.git/HEAD HTTP/1.1" 404 - - 195.26.248.142 - - [02/Nov/2026:13:27:28 -0300] "GET /.ssh/id_rsa HTTP/1.1" 404 - show less	Bad Web Bot
🇧🇪 sid3windr	2026-11-03 19:46:39 (1 day ago)	GET /.env (Tarpitted for 1d15h8m29s, wasted 8.06MB)	Web App Attack
🇧🇪 sid3windr	2026-11-03 18:10:54 (1 day ago)	GET /.env (Tarpitted for 1d15h8m26s, wasted 8.06MB)	Web App Attack
🇩🇪 Bedios GmbH	2026-11-03 17:41:21 (2 days ago)	Scanning for exposed credentials and private keys	Hacking
🇩🇪 Marco711	2026-11-03 17:38:12 (2 days ago)	CrowdSec: crowdsecurity/http-sensitive-files	Web App Attack
🇫🇷 pm33	2026-11-03 17:33:56 (2 days ago)	Unsolicited connection attempts or aggressive port scan.	Port Scan
🇫🇮 geot	2026-11-03 12:58:47 (2 days ago)	GET /.env.backup HTTP/1.1 GET /.aws/credentials HTTP/1.1 GET /.env.local HTTP/1.1 GET /.env HTTP/1.1 ... show more GET /.env.backup HTTP/1.1 GET /.aws/credentials HTTP/1.1 GET /.env.local HTTP/1.1 GET /.env HTTP/1.1 GET /.docker/config.json HTTP/1.1 GET /.aws/config HTTP/1.1 GET /.netrc HTTP/1.1 GET /config.json HTTP/1.1 GET /azureauth.json HTTP/1.1 GET /secrets.json HTTP/1.1 GET /.env.production HTTP/1.1 GET /id_rsa HTTP/1.1 GET /.kube/config HTTP/1.1 GET /.git/config HTTP/1.1 GET /.git-credentials HTTP/1.1 GET /.ssh/id_rsa HTTP/1.1 GET /.npmrc HTTP/1.1 GET /.git/HEAD HTTP/1.1 show less	Hacking Web App Attack
🇪🇸 librebit	2026-11-03 11:54:31 (2 days ago)	Brute force	Brute-Force
🇨🇭 copestack	2026-11-03 02:30:10 (2 days ago)	Honeypot hit on ov-9acb4e (fail2ban jail: nginx-compat)	Web App Attack
🇧🇷 dermatovirtual	2026-11-03 00:21:50 (2 days ago)	Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web ... show more Dermato Virtual CSIRT: Malicious web exploit/scanning probes against app.dermatovirtual.com.br (Web Server Ports 80/443). 5 unauthorized requests recorded between 2026-11-02 00:16:34 UTC and 2026-11-02 00:16:35 UTC (rate: ~5 req/min). Edge perimeter firewall drop active. Log sample: [2026-11-02 00:16:34 UTC] IP: 195.26.248.142 - W3C IIS (Port 80): GET /.env -> HTTP 500 [CLIENT: 195.26.248.142] [2026-11-02 00:16:34 UTC] IP: 195.26.248.142 - W3C IIS (Port 80): GET /.git/config -> HTTP 500 [CLIENT: 195.26.248.142] [2026-11-02 00:16:34 UTC] IP: 195.26.248.142 - W3C IIS (Port 80): GET /.env.local -> HTTP 500 [CLIENT: 195.26.248.142] show less	Bad Web Bot Web App Attack
🇺🇸 rhandorf	2026-11-02 23:42:53 (2 days ago)	Multiple web server 400 error codes from same source ip. (87 events) - reported by a home network SI ... show more Multiple web server 400 error codes from same source ip. (87 events) - reported by a home network SIEM show less	Port Scan Web App Attack
🇳🇱 oisecnet	2026-11-02 22:03:02 (2 days ago)	Automated report: Unauthorized vulnerability scanning detected on 2026-11-02. 1 requests from this I ... show more Automated report: Unauthorized vulnerability scanning detected on 2026-11-02. 1 requests from this IP. show less	Port Scan Hacking Web App Attack
🇬🇧 sc user	2026-11-02 21:33:01 (2 days ago)	Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad ... show more Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy. show less	Bad Web Bot Web App Attack Port Scan

« Previous
Next »

Showing 1 to 15 of 241 results

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇬 152.32.142.188

🇳🇱 185.242.226.19

🇸🇪 85.203.44.26

🇺🇸 66.132.186.127

🇩🇪 34.185.255.175

🇳🇱 200.138.46.45

🇵🇹 85.240.193.104

🇮🇳 168.144.116.230

🇰🇷 125.182.93.18

🇸🇦 93.112.154.23

🇺🇸 50.82.130.170

🇸🇨 41.86.38.140

🇷🇴 2.57.121.112

🇷🇴 193.46.255.86

🇸🇪 185.246.130.20

🇫🇷 172.71.127.19

🇺🇸 172.56.36.255

🇫🇷 163.172.66.206

🇺🇸 162.81.133.50

🇺🇸 136.67.196.157